FileDeleted

[Michael Platt]

We see a bunch of file deleted activities in the activity log and they kind of pile up and making it hard to filter out.  These are even at times when users are not on their workstations so it must be something the OS is doing.

I've included a screenshot of how they show up in MCAS.  Also below is the raw data minus some personal info.

{
"OrganizationId": "ORGID",
"CreationTime": "2020-12-17T13:15:37.0000000Z",
"RecordType": 63,
"Operation": "FileDeleted",
"UserType": 0,
"Workload": "Endpoint",
"ClientIP": "MYIP",
"UserKey": "MYEMAIL@MYDOMAIN.COM",
"Version": 1,
"UserId": "MYEMAIL@MYDOMAIN.COM",
"ObjectId": "C:\\Users\\MYDEVICE\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{84296cf9-e999-4161-8bbe-3a5192034643}\\0.2.filtertrie.intermediate.txt",
"Id": "ID",
"SourceLocationType": 1,
"MDATPDeviceId": "73bfc51f276dea70fc65542fb64b662691",
"FileType": "TEXT",
"FileExtension": "txt",
"Application": "RuntimeBroker.exe",
"DeviceName": "MYDEVICE",
"FileSize": 0,
"Platform": 1,
"Hidden": false,
"Scope": 1
} 

[#2]

@Michael Platt just replying here to follow the thread, but don't have a straight answer.

I guess this is by design when you do MCAS and MDATP integration. Do you have policies for massive file deletion?  Might want to tweak that a little, because I don't think you can do anything about the audit data.